Phone cameras create an intensely personal archive spanning everything from family life to identity documents. Yet with most mainstream photo services, the server is technically able to process the files. Ente Photos proposes a different balance: It encrypts photos and videos on the user’s device before they are uploaded, while managing the keys required for viewing, searching, and sharing so that the service provider cannot read the content. With support for Android, iOS, Windows, macOS, Linux, and the web, this approach is no longer an experimental project aimed solely at security enthusiasts. But is Ente convenient enough to replace Google Photos or iCloud Photos in everyday use?
First impressions: Privacy successfully stays out of sight
One of Ente’s greatest strengths is that it does not turn encryption into a process that constantly confronts users with technical details. The mobile app lets you select which folders to back up, while folders or exports such as Google Takeout can be dropped into the desktop app. Familiar gallery tools are available, including a timeline, albums, favorites, an archive, hidden content, a map, and memories. Photos are stored in their original quality, while dates, locations, and other important metadata are preserved.
The desktop app’s “watched folder” feature uploads files subsequently added to a designated local folder to Ente in the background. However, this mechanism is not two-way synchronization. Ente’s own documentation warns that using the same location for the export destination and the watched folder can result in duplicate files or stalled transfers. The app should therefore be regarded not as Dropbox-style bidirectional file synchronization, but as a one-way automatic backup tool for a photo archive.
The duration of the first large transfer depends on the archive’s size, the connection, and the device’s encryption performance. Preparing encrypted thumbnails and building the local search index can also consume time and energy during the initial setup. Although everyday operation is straightforward, anyone moving a library containing tens of thousands of items would be safer using the desktop app and verifying the process in stages.
Intelligent search works without exposing photos to the server
Search has traditionally been the weakness of encrypted photo services: If the server cannot see an image, how can it recognize objects or faces? Ente moves machine-learning processing onto the user’s device. The models required for face grouping and natural-language photo searches run on the device, and the resulting index can be synchronized in encrypted form. This means everything does not have to be recalculated from scratch when the archive is accessed on another device.
This approach is strong from a privacy perspective, but users should not expect the same speed and precision as the vast server infrastructure of major cloud providers. Initial indexing can strain the battery, processor, and storage, while unusual objects, vague location descriptions, or similar-looking faces may produce inaccurate results. The best approach is to treat search as a helpful tool while continuing to organize important photos in albums and favorites.
Sharing is convenient, but link security depends on the user
When an album is shared between Ente users, the required album key is protected with the recipient’s public key. Public links that open in a browser can also be created for people without accounts. The decryption key in these links is added to the URL fragment, which is not sent to the server. Although the server does not see the photos in unencrypted form, anyone who obtains the link can open the content. For sensitive albums, it is essential to set a separate password, expiration time, and device limit, and to avoid publishing the link through public channels.
The ability to permit uploads through a link is useful for collecting wedding or travel photos. Participants do not need to create accounts, and uploaded files are also end-to-end encrypted. However, those files count against the album owner’s storage allowance. According to the official help page, creating shares and changing existing sharing settings require a paid subscription, while free users can view albums shared with them.
How well do independent audits support the security claims?
The fact that Ente’s client and server code is open source is important, but it is not proof that the software is free of flaws. Independent reviews whose findings are published provide a more valuable indicator. Cure53’s 2023 cryptographic assessment examined end-to-end encryption, key management, password processing, and the sharing design, reporting that the architecture used established tools such as libsodium and Argon2 appropriately.
A broader penetration test published in October 2025 presented a more critical picture. Auditors found several vulnerabilities in authentication, TOTP and passkey flows, email processing, and file uploads. According to the summary report, Ente had fixed 12 of the 15 identified issues by the retesting stage. This included every critical and high-impact finding and all but one of the medium-impact findings. That does not mean Ente has never had a vulnerability. The real positive is that the findings were published in detail, serious issues were resolved, and the fixes were verified by an independent team. Even so, users should choose a strong, unique password, enable multifactor authentication, and store the recovery key offline.
Another significant cost of end-to-end encryption is the user’s responsibility for recovery. If both the password and recovery key are lost, the provider cannot be expected to decrypt the photos and recover the account. Care is also necessary when sending error logs to the support team: Ente’s help documentation explicitly states that logs may contain sensitive information such as file names.
Pricing and data portability
At the time of this review, the official pricing page offered free accounts 10 GB. With annual billing, the 50 GB plan worked out to $2.49 per month, the 200 GB plan to $4.99, the 1 TB plan to $9.99, and the 2 TB plan to $19.99. The total amount may vary because of taxes, exchange rates, and purchases made through app stores. Paid storage can be shared with up to five family members, while each member’s photos remain separate from everyone else’s.
The free 10 GB is enough to test the app and its search performance, but users who regularly shoot video will quickly fill the allowance. The fee, however, pays for more than capacity: It also covers client-side encryption, support for different operating systems, a paid three-copy storage arrangement, and human support. Ente’s desktop export tool and open-source code reduce the risk of becoming dependent on the service. Still, no cloud service should count as the sole backup. A second, regularly exported copy of the photos should be kept on an external drive or in another trusted location.
Conclusion: Who should switch?
Ente Photos is a strong option for people who do not want their photos exposed to advertising profiles or server-side AI processing, use multiple operating systems, and are willing to pay for a subscription. Its interface keeps encrypted storage practical for everyday use, while on-device face grouping, natural-language search, shared albums, and export tools meet most essential needs.
It is not suitable, however, for those seeking unlimited free space, those who want the most advanced server-based photo search, or those unwilling to accept responsibility for managing a recovery key. The healthiest way to switch is to begin by uploading a sample archive spanning a few months to the free plan, genuinely test search, sharing, and export, and move the larger library only after confirming that the original files and metadata can be retrieved. Under these conditions, Ente Photos is one of the most balanced photo services currently available in terms of privacy and ease of use. It should, however, be regarded not as a replacement for a local backup, but as the encrypted cloud component of a well-designed, multilayered archive plan.